Mandiant Event Filter Rules API
The suppressed event filter rule API endpoints interact with the rules governing an event matching a Job Action. An suppressing or dropping EventFilterRule will prevent an Integration event from having a normal relationship with a Job Action. A suppressed or dropped event will not contribute to the prevented/alerted/detected/missed set of statistics for a Job Action. The event's relationship will be considered suppressed or dropped depending on the rule configuration and the global Director settings. A kept EventFilterRule will override suppressing or dropping rules depending on the numerical priority. This can be used to establish "normal" or expected event matching behavior. For example, a priority 5 rule to suppress all events from Host CLI actions can be overridden by a priority 3 rule to keep all events from a particular Integration. A Suppressing or Dropping EventFilterRule differ from a normal IntegrationEventFilter in the way the event and the Job Action relate to each other. * Events that are Suppressed or Dropped via EventFilterRules and not by IntegrationEventFilters will not contribute any statistics to the Job Action, the event will not be considered a "real" event for the Job Action, and the only record that the event has any relationship at all to the Job Action is that there will be a SuppressedEvent/DroppedEvent object created and attached to the Job Action afterward. * Events that are altered by the IntegrationEventFilter and not by EventFilterRules will still be considered "real" events attached to the Job Action, however the event cannot be considered "detected" by the Job Action. * Events that are eligible to be Suppressed or Dropped by an EventFilterRule but also eligible to be altered by an IntegrationEventFilter will be Suppressed or Dropped only. The event will not be linked to the Job Action and therefore will not be considered detected (or prevented or missed or anything)